How do I install the Ca Checkpoint skill?

Run npx skillmds@latest add majiayu000/ca-checkpoint-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ca Checkpoint safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ca Checkpoint?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ca Checkpoint free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ca Checkpoint?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ca Checkpoint by majiayu000 — Agent Skill

Name: Ca Checkpoint
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

$ca-checkpoint — codebase sweep

Periodic sweep of the entire codebase with the reviewer fleet, funneled to a single dated report. Surfaces findings — not a promotion gate, enforces no sign-off.

Flow

Build the unit list — the same fleet as $ca-review, scoped to the whole codebase against the <project-root>/.codearbiter/ docs:

Reviewer	Reads
`security-reviewer`	`security-controls.md`; reviews security posture
`auth-crypto-reviewer`	`security-controls.md`; authn/crypto/key/secret paths
`dependency-reviewer`	dependency manifests; license + supply-chain posture
`migration-reviewer`	migration history; safety + classification
`coverage-auditor`	test coverage vs. obligations across the tree
`architecture-drift-reviewer`	`decisions/`; drift between code and accepted ADRs

Route to dispatching-parallel-agents with that unit list (read-only batch). It dedupes, then funnels through finding-triage → checkpoint-aggregator.
checkpoint-aggregator writes the dated report to <project-root>/.codearbiter/checkpoints/YYYY-MM-DD.md: findings by severity with file:line, and out-of-scope items marked inline [NEEDS-TRIAGE].
Write the current override count to <project-root>/.codearbiter/last-checkpoint — the integer baseline the startup briefing subtracts for its overrides-since-checkpoint counter. The value is the number of non-comment, non-blank lines in overrides.log at this moment (0 if the log is absent). This re-zeros the over:N segment until the next $ca-override. Write a bare integer, not a timestamp — the briefing treats any value above the current total as stale and falls back to showing every override.
Report the checkpoint path.

Hard gate

Read-only except writing the checkpoint doc and last-checkpoint — MUST NOT modify code. MUST NOT consume raw reviewer output — only the finding-triage → checkpoint-aggregator verdict. MUST NOT resolve a [CONFIRM-NN] surfaced during the sweep by guessing. The report surfaces findings; it does not block or sign off anything.

When NOT to use

Reviewing just the current diff → $ca-review.
A pre-implementation threat model → $ca-threat-model.
ADR health only → $ca-adr-status.
A whole-codebase deep audit → $ca-tribunal (checkpoint is the lean periodic sweep; tribunal its rare deep counterpart).

---name: ca-checkpoint-2description: Periodic multi-reviewer sweep of the whole codebase — surfaces a triaged checkpoint report.---# $ca-checkpoint — codebase sweepPeriodic sweep of the entire codebase with the reviewer fleet, funneled to a single dated report. Surfaces findings — not a promotion gate, enforces no sign-off.## Flow1. Build the unit list — the same fleet as `$ca-review`, scoped to the whole codebase against the `<project-root>/.codearbiter/` docs: | Reviewer | Reads | |---|---| | `security-reviewer` | `security-controls.md`; reviews security posture | | `auth-crypto-reviewer` | `security-controls.md`; authn/crypto/key/secret paths | | `dependency-reviewer` | dependency manifests; license + supply-chain posture | | `migration-reviewer` | migration history; safety + classification | | `coverage-auditor` | test coverage vs. obligations across the tree | | `architecture-drift-reviewer` | `decisions/`; drift between code and accepted ADRs |2. Route to `dispatching-parallel-agents` with that unit list (read-only batch). It dedupes, then funnels through `finding-triage` → `checkpoint-aggregator`.3. `checkpoint-aggregator` writes the dated report to `<project-root>/.codearbiter/checkpoints/YYYY-MM-DD.md`: findings by severity with file:line, and out-of-scope items marked inline `[NEEDS-TRIAGE]`.4. Write the current override **count** to `<project-root>/.codearbiter/last-checkpoint` — the integer baseline the startup briefing subtracts for its overrides-since-checkpoint counter. The value is the number of non-comment, non-blank lines in `overrides.log` at this moment (`0` if the log is absent). This re-zeros the `over:N` segment until the next `$ca-override`. Write a bare integer, not a timestamp — the briefing treats any value above the current total as stale and falls back to showing every override.5. Report the checkpoint path.## Hard gateRead-only except writing the checkpoint doc and `last-checkpoint` — MUST NOT modify code. MUST NOTconsume raw reviewer output — only the `finding-triage` → `checkpoint-aggregator` verdict. MUST NOTresolve a `[CONFIRM-NN]` surfaced during the sweep by guessing. The report surfaces findings; it doesnot block or sign off anything.## When NOT to use- Reviewing just the current diff → `$ca-review`.- A pre-implementation threat model → `$ca-threat-model`.- ADR health only → `$ca-adr-status`.- A whole-codebase deep audit → `$ca-tribunal` (checkpoint is the lean periodic sweep; tribunal its rare deep counterpart).

Frequently asked questions

Ca Checkpoint